Privacy Policy

1. Who controls your data

RestMalta, operating in Malta, is the data controller for the personal data described in this policy. For any privacy question, see our Contact page.

2. What we collect

Category	Examples
Account data	Name, email, phone number, password (hashed)
Identity data	ID/passport, selfie for verification, nationality
Financial data	IBAN, payment card details (processed by Stripe, not stored by us), commission records
Rental data	Listings, applications, lease documents, move-in inventories, messages
Technical data	IP address, device/browser type, pages visited

3. Why we collect it

• To provide the service — matching tenants with landlords, generating leases, processing applications
• Identity verification — so landlords can trust the applicants they review
• Payments — processing platform fees and, for agencies, subscriptions, via Stripe
• Legal compliance — Maltese lease law requires certain identifying information on the lease itself
• Communication — enabling messages between landlords, tenants and agencies

4. Legal basis (GDPR)

We process personal data on the basis of: performance of a contract (providing the rental-matching service you signed up for), legal obligation (lease registration requirements), and consent (e.g. optional marketing communications, where applicable).

5. Who we share data with

• The other party to a transaction (e.g. a landlord sees a tenant's dossier once they apply; a tenant sees landlord identification once required for a lease)
• Service providers we rely on to operate the platform: Supabase (database/storage), Clerk (authentication), Stripe (payments), DocuSeal (e-signatures), Resend (transactional email)
• Authorities, where required by law (e.g. lease registration with the Housing Authority is the landlord's own responsibility, not something RestMalta submits on their behalf)

We do not sell personal data to third parties.

6. How long we keep it

We retain account and rental data for as long as your account is active, and for a reasonable period afterward to comply with legal, tax or dispute-resolution obligations. Identity documents are retained only as long as necessary for verification and dossier purposes.

7. Your rights

Under the GDPR, you have the right to access, correct, delete, or export your personal data, and to object to or restrict certain processing. To exercise these rights, contact us via the Contact page. You also have the right to lodge a complaint with Malta's Information and Data Protection Commissioner (IDPC).

8. Cookies

Details on cookies and similar technologies are covered separately in our Cookie Policy.

9. Security

We use industry-standard measures (encrypted storage, access controls, secure payment processing via Stripe) to protect personal data, though no system can be guaranteed 100% secure.

10. Changes to this policy

We may update this policy from time to time; the "Last updated" date above will reflect the most recent revision.